How you add a friend, and what we never ask for

Puzzle Lantern will not find anybody for you. There is no directory to browse, no list of suggested players, nothing that reads your address book. There are exactly two ways in, a link somebody sends you or a request to a username you already know, and neither of them creates anything until the other person says yes.

The link is the main path

Share invite mints a fresh link and hands it straight to the share sheet your phone already has. After that it behaves like any other link. Put it in a message, drop it into a group chat, read it out across the table. The app plays no part in how it travels and never learns where it went.

Whoever opens the link lands on a small web page naming the person who sent it, with a button to open the app. Inside the app there is one more screen: this is who invited you, accept or decline. Nothing is created before that tap. An invite that is opened, read and left alone builds no connection, and no half-formed relationship sits waiting in either account.

What an invite token actually is

The link ends in a token, and the token is deliberately dull: thirty-two random bytes, written out as text. It is not your username rearranged, it is not an account number, it is not derived from you in any way. There is nothing in it to read.

The server does not keep the token either. It stores a hash of it, which is enough to recognise a link that comes back and not enough to reconstruct one. The name you see on the invite page is not carried by the link, it is asked for: the page sends the token to the server, and the server answers only while that invite is still live. You can revoke a link you have shared, and every link stops working thirty days after it was made.

When the app is not installed yet

An invite often arrives before the app does. Somebody taps a link in a message, on a phone that has never had Puzzle Lantern on it, and the link has to do something useful anyway. That awkward case is the whole reason the invite page is a real page rather than a redirect.

Tap Open in the app and, if nothing has happened after about a second and a half, the page says so and points you at the store instead. What it will not do is move you on by itself. It stays exactly where it is, still holding the token, so you can install the app, come back to that same page in your browser, tap Open a second time and finish the invitation you were sent. The page is what carries an invite across an installation, which is why it is built to sit still.

Every shortcut we left out is a permission the app never has to ask you for.

The other way in: an exact username

Not every friendship starts with a link. Sometimes you already know somebody’s username, because they told you, and the sensible thing is to type it in. So you can: open Add friend, type the username exactly as it is, and send a request.

Exactly is the operative word. There is no search box that offers suggestions as you type, no autocomplete, nothing to browse. The input matches one handle or it matches nothing, and you are not told which. Sending is blind on purpose: the app answers the same way whether the account exists, does not exist, or belongs to somebody who has blocked you. A stranger cannot sit there feeding in guesses to learn who is registered, because the reply never changes.

What happens next is the same as with a link. The request appears in the other person’s app, named for whoever sent it, and it becomes a friendship only when they accept. Declining is silent, so nobody has to explain themselves. If two people happen to request each other, the app takes the hint and connects them.

Slower, and worth it

There is no pretending this is the quick option. Reading an address book would connect you to twenty people in a single tap. It would also mean twenty people were connected to you without being asked, and it would mean the app was holding a copy of your contacts in order to manage it. Both of our paths are slower because two people each have to decide something: one to reach out, one to accept.

So there is no contact syncing and no contact discovery, and the app never requests the Contacts permission, because nothing inside it would use one. There is no username search, no autocomplete and no “players you may know”. There are no friend codes to generate or read out. Knowing a username lets you ask; it does not let you look anybody up, browse to them, or arrive at them by accident.

What you get in return is deliberately small. There is no messaging, no feed and nothing to post. The day’s leaderboard for a game grows a Friends tab beside the global one, showing how the people you invited got on with the same puzzle on the same date. That is the whole of it, and it is enough: a short list of people you actually know is a nicer thing to open in the morning than a long list of strangers.

A friends list built one yes at a time stays small. We would rather it did.